IIRC, the final search results when using appendcols (or other subsearch methods), the only results you see from the final results viewpoint is the output of the subsearch (appendcols) command. More specifically, it works like this:
- search starts, gets some data
- appendcols (or other subsearch) command then happens
- appendcols (other subsearch) completes and outputs the results back to the original search as input
- original search finishes or pipes to subsequent commands
So, thinking of this process, the output of the appendcols (subsearch) command(s) is a limited set of data. The search it performed is not preserved in this process; only the output is preserved. Therefore, you cannot drill down because you are already at the most original format of data from the final result perspective.
To work around this problem you could push subsearch results to a summary index or use scheduled searches that store the data that you can then later drill into without performing the original search again from the beginning.
--
Jesse Trucks
Minister of Magic
